1 /* 2 * ARM page table walking. 3 * 4 * This code is licensed under the GNU GPL v2 or later. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 9 #include "qemu/osdep.h" 10 #include "qemu/log.h" 11 #include "qemu/range.h" 12 #include "qemu/main-loop.h" 13 #include "exec/exec-all.h" 14 #include "cpu.h" 15 #include "internals.h" 16 #include "idau.h" 17 18 19 typedef struct S1Translate { 20 ARMMMUIdx in_mmu_idx; 21 ARMMMUIdx in_ptw_idx; 22 bool in_secure; 23 bool in_debug; 24 bool out_secure; 25 bool out_rw; 26 bool out_be; 27 hwaddr out_virt; 28 hwaddr out_phys; 29 void *out_host; 30 } S1Translate; 31 32 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, 33 uint64_t address, 34 MMUAccessType access_type, bool s1_is_el0, 35 GetPhysAddrResult *result, ARMMMUFaultInfo *fi) 36 __attribute__((nonnull)); 37 38 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw, 39 target_ulong address, 40 MMUAccessType access_type, 41 GetPhysAddrResult *result, 42 ARMMMUFaultInfo *fi) 43 __attribute__((nonnull)); 44 45 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */ 46 static const uint8_t pamax_map[] = { 47 [0] = 32, 48 [1] = 36, 49 [2] = 40, 50 [3] = 42, 51 [4] = 44, 52 [5] = 48, 53 [6] = 52, 54 }; 55 56 /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */ 57 unsigned int arm_pamax(ARMCPU *cpu) 58 { 59 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { 60 unsigned int parange = 61 FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE); 62 63 /* 64 * id_aa64mmfr0 is a read-only register so values outside of the 65 * supported mappings can be considered an implementation error. 66 */ 67 assert(parange < ARRAY_SIZE(pamax_map)); 68 return pamax_map[parange]; 69 } 70 71 /* 72 * In machvirt_init, we call arm_pamax on a cpu that is not fully 73 * initialized, so we can't rely on the propagation done in realize. 74 */ 75 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE) || 76 arm_feature(&cpu->env, ARM_FEATURE_V7VE)) { 77 /* v7 with LPAE */ 78 return 40; 79 } 80 /* Anything else */ 81 return 32; 82 } 83 84 /* 85 * Convert a possible stage1+2 MMU index into the appropriate stage 1 MMU index 86 */ 87 ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx) 88 { 89 switch (mmu_idx) { 90 case ARMMMUIdx_E10_0: 91 return ARMMMUIdx_Stage1_E0; 92 case ARMMMUIdx_E10_1: 93 return ARMMMUIdx_Stage1_E1; 94 case ARMMMUIdx_E10_1_PAN: 95 return ARMMMUIdx_Stage1_E1_PAN; 96 default: 97 return mmu_idx; 98 } 99 } 100 101 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) 102 { 103 return stage_1_mmu_idx(arm_mmu_idx(env)); 104 } 105 106 static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx) 107 { 108 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0; 109 } 110 111 /* Return the TTBR associated with this translation regime */ 112 static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn) 113 { 114 if (mmu_idx == ARMMMUIdx_Stage2) { 115 return env->cp15.vttbr_el2; 116 } 117 if (mmu_idx == ARMMMUIdx_Stage2_S) { 118 return env->cp15.vsttbr_el2; 119 } 120 if (ttbrn == 0) { 121 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)]; 122 } else { 123 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)]; 124 } 125 } 126 127 /* Return true if the specified stage of address translation is disabled */ 128 static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx, 129 bool is_secure) 130 { 131 uint64_t hcr_el2; 132 133 if (arm_feature(env, ARM_FEATURE_M)) { 134 switch (env->v7m.mpu_ctrl[is_secure] & 135 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) { 136 case R_V7M_MPU_CTRL_ENABLE_MASK: 137 /* Enabled, but not for HardFault and NMI */ 138 return mmu_idx & ARM_MMU_IDX_M_NEGPRI; 139 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK: 140 /* Enabled for all cases */ 141 return false; 142 case 0: 143 default: 144 /* 145 * HFNMIENA set and ENABLE clear is UNPREDICTABLE, but 146 * we warned about that in armv7m_nvic.c when the guest set it. 147 */ 148 return true; 149 } 150 } 151 152 hcr_el2 = arm_hcr_el2_eff_secstate(env, is_secure); 153 154 switch (mmu_idx) { 155 case ARMMMUIdx_Stage2: 156 case ARMMMUIdx_Stage2_S: 157 /* HCR.DC means HCR.VM behaves as 1 */ 158 return (hcr_el2 & (HCR_DC | HCR_VM)) == 0; 159 160 case ARMMMUIdx_E10_0: 161 case ARMMMUIdx_E10_1: 162 case ARMMMUIdx_E10_1_PAN: 163 /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */ 164 if (hcr_el2 & HCR_TGE) { 165 return true; 166 } 167 break; 168 169 case ARMMMUIdx_Stage1_E0: 170 case ARMMMUIdx_Stage1_E1: 171 case ARMMMUIdx_Stage1_E1_PAN: 172 /* HCR.DC means SCTLR_EL1.M behaves as 0 */ 173 if (hcr_el2 & HCR_DC) { 174 return true; 175 } 176 break; 177 178 case ARMMMUIdx_E20_0: 179 case ARMMMUIdx_E20_2: 180 case ARMMMUIdx_E20_2_PAN: 181 case ARMMMUIdx_E2: 182 case ARMMMUIdx_E3: 183 break; 184 185 case ARMMMUIdx_Phys_NS: 186 case ARMMMUIdx_Phys_S: 187 /* No translation for physical address spaces. */ 188 return true; 189 190 default: 191 g_assert_not_reached(); 192 } 193 194 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0; 195 } 196 197 static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs) 198 { 199 /* 200 * For an S1 page table walk, the stage 1 attributes are always 201 * some form of "this is Normal memory". The combined S1+S2 202 * attributes are therefore only Device if stage 2 specifies Device. 203 * With HCR_EL2.FWB == 0 this is when descriptor bits [5:4] are 0b00, 204 * ie when cacheattrs.attrs bits [3:2] are 0b00. 205 * With HCR_EL2.FWB == 1 this is when descriptor bit [4] is 0, ie 206 * when cacheattrs.attrs bit [2] is 0. 207 */ 208 if (hcr & HCR_FWB) { 209 return (attrs & 0x4) == 0; 210 } else { 211 return (attrs & 0xc) == 0; 212 } 213 } 214 215 /* Translate a S1 pagetable walk through S2 if needed. */ 216 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw, 217 hwaddr addr, ARMMMUFaultInfo *fi) 218 { 219 bool is_secure = ptw->in_secure; 220 ARMMMUIdx mmu_idx = ptw->in_mmu_idx; 221 ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx; 222 uint8_t pte_attrs; 223 bool pte_secure; 224 225 ptw->out_virt = addr; 226 227 if (unlikely(ptw->in_debug)) { 228 /* 229 * From gdbstub, do not use softmmu so that we don't modify the 230 * state of the cpu at all, including softmmu tlb contents. 231 */ 232 if (regime_is_stage2(s2_mmu_idx)) { 233 S1Translate s2ptw = { 234 .in_mmu_idx = s2_mmu_idx, 235 .in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS, 236 .in_secure = is_secure, 237 .in_debug = true, 238 }; 239 GetPhysAddrResult s2 = { }; 240 241 if (!get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD, 242 false, &s2, fi)) { 243 goto fail; 244 } 245 ptw->out_phys = s2.f.phys_addr; 246 pte_attrs = s2.cacheattrs.attrs; 247 pte_secure = s2.f.attrs.secure; 248 } else { 249 /* Regime is physical. */ 250 ptw->out_phys = addr; 251 pte_attrs = 0; 252 pte_secure = is_secure; 253 } 254 ptw->out_host = NULL; 255 ptw->out_rw = false; 256 } else { 257 CPUTLBEntryFull *full; 258 int flags; 259 260 env->tlb_fi = fi; 261 flags = probe_access_full(env, addr, MMU_DATA_LOAD, 262 arm_to_core_mmu_idx(s2_mmu_idx), 263 true, &ptw->out_host, &full, 0); 264 env->tlb_fi = NULL; 265 266 if (unlikely(flags & TLB_INVALID_MASK)) { 267 goto fail; 268 } 269 ptw->out_phys = full->phys_addr; 270 ptw->out_rw = full->prot & PAGE_WRITE; 271 pte_attrs = full->pte_attrs; 272 pte_secure = full->attrs.secure; 273 } 274 275 if (regime_is_stage2(s2_mmu_idx)) { 276 uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure); 277 278 if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) { 279 /* 280 * PTW set and S1 walk touched S2 Device memory: 281 * generate Permission fault. 282 */ 283 fi->type = ARMFault_Permission; 284 fi->s2addr = addr; 285 fi->stage2 = true; 286 fi->s1ptw = true; 287 fi->s1ns = !is_secure; 288 return false; 289 } 290 } 291 292 /* Check if page table walk is to secure or non-secure PA space. */ 293 ptw->out_secure = (is_secure 294 && !(pte_secure 295 ? env->cp15.vstcr_el2 & VSTCR_SW 296 : env->cp15.vtcr_el2 & VTCR_NSW)); 297 ptw->out_be = regime_translation_big_endian(env, mmu_idx); 298 return true; 299 300 fail: 301 assert(fi->type != ARMFault_None); 302 fi->s2addr = addr; 303 fi->stage2 = true; 304 fi->s1ptw = true; 305 fi->s1ns = !is_secure; 306 return false; 307 } 308 309 /* All loads done in the course of a page table walk go through here. */ 310 static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw, 311 ARMMMUFaultInfo *fi) 312 { 313 CPUState *cs = env_cpu(env); 314 void *host = ptw->out_host; 315 uint32_t data; 316 317 if (likely(host)) { 318 /* Page tables are in RAM, and we have the host address. */ 319 data = qatomic_read((uint32_t *)host); 320 if (ptw->out_be) { 321 data = be32_to_cpu(data); 322 } else { 323 data = le32_to_cpu(data); 324 } 325 } else { 326 /* Page tables are in MMIO. */ 327 MemTxAttrs attrs = { .secure = ptw->out_secure }; 328 AddressSpace *as = arm_addressspace(cs, attrs); 329 MemTxResult result = MEMTX_OK; 330 331 if (ptw->out_be) { 332 data = address_space_ldl_be(as, ptw->out_phys, attrs, &result); 333 } else { 334 data = address_space_ldl_le(as, ptw->out_phys, attrs, &result); 335 } 336 if (unlikely(result != MEMTX_OK)) { 337 fi->type = ARMFault_SyncExternalOnWalk; 338 fi->ea = arm_extabort_type(result); 339 return 0; 340 } 341 } 342 return data; 343 } 344 345 static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw, 346 ARMMMUFaultInfo *fi) 347 { 348 CPUState *cs = env_cpu(env); 349 void *host = ptw->out_host; 350 uint64_t data; 351 352 if (likely(host)) { 353 /* Page tables are in RAM, and we have the host address. */ 354 #ifdef CONFIG_ATOMIC64 355 data = qatomic_read__nocheck((uint64_t *)host); 356 if (ptw->out_be) { 357 data = be64_to_cpu(data); 358 } else { 359 data = le64_to_cpu(data); 360 } 361 #else 362 if (ptw->out_be) { 363 data = ldq_be_p(host); 364 } else { 365 data = ldq_le_p(host); 366 } 367 #endif 368 } else { 369 /* Page tables are in MMIO. */ 370 MemTxAttrs attrs = { .secure = ptw->out_secure }; 371 AddressSpace *as = arm_addressspace(cs, attrs); 372 MemTxResult result = MEMTX_OK; 373 374 if (ptw->out_be) { 375 data = address_space_ldq_be(as, ptw->out_phys, attrs, &result); 376 } else { 377 data = address_space_ldq_le(as, ptw->out_phys, attrs, &result); 378 } 379 if (unlikely(result != MEMTX_OK)) { 380 fi->type = ARMFault_SyncExternalOnWalk; 381 fi->ea = arm_extabort_type(result); 382 return 0; 383 } 384 } 385 return data; 386 } 387 388 static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val, 389 uint64_t new_val, S1Translate *ptw, 390 ARMMMUFaultInfo *fi) 391 { 392 uint64_t cur_val; 393 void *host = ptw->out_host; 394 395 if (unlikely(!host)) { 396 fi->type = ARMFault_UnsuppAtomicUpdate; 397 fi->s1ptw = true; 398 return 0; 399 } 400 401 /* 402 * Raising a stage2 Protection fault for an atomic update to a read-only 403 * page is delayed until it is certain that there is a change to make. 404 */ 405 if (unlikely(!ptw->out_rw)) { 406 int flags; 407 void *discard; 408 409 env->tlb_fi = fi; 410 flags = probe_access_flags(env, ptw->out_virt, MMU_DATA_STORE, 411 arm_to_core_mmu_idx(ptw->in_ptw_idx), 412 true, &discard, 0); 413 env->tlb_fi = NULL; 414 415 if (unlikely(flags & TLB_INVALID_MASK)) { 416 assert(fi->type != ARMFault_None); 417 fi->s2addr = ptw->out_virt; 418 fi->stage2 = true; 419 fi->s1ptw = true; 420 fi->s1ns = !ptw->in_secure; 421 return 0; 422 } 423 424 /* In case CAS mismatches and we loop, remember writability. */ 425 ptw->out_rw = true; 426 } 427 428 #ifdef CONFIG_ATOMIC64 429 if (ptw->out_be) { 430 old_val = cpu_to_be64(old_val); 431 new_val = cpu_to_be64(new_val); 432 cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val); 433 cur_val = be64_to_cpu(cur_val); 434 } else { 435 old_val = cpu_to_le64(old_val); 436 new_val = cpu_to_le64(new_val); 437 cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val); 438 cur_val = le64_to_cpu(cur_val); 439 } 440 #else 441 /* 442 * We can't support the full 64-bit atomic cmpxchg on the host. 443 * Because this is only used for FEAT_HAFDBS, which is only for AA64, 444 * we know that TCG_OVERSIZED_GUEST is set, which means that we are 445 * running in round-robin mode and could only race with dma i/o. 446 */ 447 #ifndef TCG_OVERSIZED_GUEST 448 # error "Unexpected configuration" 449 #endif 450 bool locked = qemu_mutex_iothread_locked(); 451 if (!locked) { 452 qemu_mutex_lock_iothread(); 453 } 454 if (ptw->out_be) { 455 cur_val = ldq_be_p(host); 456 if (cur_val == old_val) { 457 stq_be_p(host, new_val); 458 } 459 } else { 460 cur_val = ldq_le_p(host); 461 if (cur_val == old_val) { 462 stq_le_p(host, new_val); 463 } 464 } 465 if (!locked) { 466 qemu_mutex_unlock_iothread(); 467 } 468 #endif 469 470 return cur_val; 471 } 472 473 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx, 474 uint32_t *table, uint32_t address) 475 { 476 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */ 477 uint64_t tcr = regime_tcr(env, mmu_idx); 478 int maskshift = extract32(tcr, 0, 3); 479 uint32_t mask = ~(((uint32_t)0xffffffffu) >> maskshift); 480 uint32_t base_mask; 481 482 if (address & mask) { 483 if (tcr & TTBCR_PD1) { 484 /* Translation table walk disabled for TTBR1 */ 485 return false; 486 } 487 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000; 488 } else { 489 if (tcr & TTBCR_PD0) { 490 /* Translation table walk disabled for TTBR0 */ 491 return false; 492 } 493 base_mask = ~((uint32_t)0x3fffu >> maskshift); 494 *table = regime_ttbr(env, mmu_idx, 0) & base_mask; 495 } 496 *table |= (address >> 18) & 0x3ffc; 497 return true; 498 } 499 500 /* 501 * Translate section/page access permissions to page R/W protection flags 502 * @env: CPUARMState 503 * @mmu_idx: MMU index indicating required translation regime 504 * @ap: The 3-bit access permissions (AP[2:0]) 505 * @domain_prot: The 2-bit domain access permissions 506 * @is_user: TRUE if accessing from PL0 507 */ 508 static int ap_to_rw_prot_is_user(CPUARMState *env, ARMMMUIdx mmu_idx, 509 int ap, int domain_prot, bool is_user) 510 { 511 if (domain_prot == 3) { 512 return PAGE_READ | PAGE_WRITE; 513 } 514 515 switch (ap) { 516 case 0: 517 if (arm_feature(env, ARM_FEATURE_V7)) { 518 return 0; 519 } 520 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) { 521 case SCTLR_S: 522 return is_user ? 0 : PAGE_READ; 523 case SCTLR_R: 524 return PAGE_READ; 525 default: 526 return 0; 527 } 528 case 1: 529 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 530 case 2: 531 if (is_user) { 532 return PAGE_READ; 533 } else { 534 return PAGE_READ | PAGE_WRITE; 535 } 536 case 3: 537 return PAGE_READ | PAGE_WRITE; 538 case 4: /* Reserved. */ 539 return 0; 540 case 5: 541 return is_user ? 0 : PAGE_READ; 542 case 6: 543 return PAGE_READ; 544 case 7: 545 if (!arm_feature(env, ARM_FEATURE_V6K)) { 546 return 0; 547 } 548 return PAGE_READ; 549 default: 550 g_assert_not_reached(); 551 } 552 } 553 554 /* 555 * Translate section/page access permissions to page R/W protection flags 556 * @env: CPUARMState 557 * @mmu_idx: MMU index indicating required translation regime 558 * @ap: The 3-bit access permissions (AP[2:0]) 559 * @domain_prot: The 2-bit domain access permissions 560 */ 561 static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, 562 int ap, int domain_prot) 563 { 564 return ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot, 565 regime_is_user(env, mmu_idx)); 566 } 567 568 /* 569 * Translate section/page access permissions to page R/W protection flags. 570 * @ap: The 2-bit simple AP (AP[2:1]) 571 * @is_user: TRUE if accessing from PL0 572 */ 573 static int simple_ap_to_rw_prot_is_user(int ap, bool is_user) 574 { 575 switch (ap) { 576 case 0: 577 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 578 case 1: 579 return PAGE_READ | PAGE_WRITE; 580 case 2: 581 return is_user ? 0 : PAGE_READ; 582 case 3: 583 return PAGE_READ; 584 default: 585 g_assert_not_reached(); 586 } 587 } 588 589 static int simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap) 590 { 591 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx)); 592 } 593 594 static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw, 595 uint32_t address, MMUAccessType access_type, 596 GetPhysAddrResult *result, ARMMMUFaultInfo *fi) 597 { 598 int level = 1; 599 uint32_t table; 600 uint32_t desc; 601 int type; 602 int ap; 603 int domain = 0; 604 int domain_prot; 605 hwaddr phys_addr; 606 uint32_t dacr; 607 608 /* Pagetable walk. */ 609 /* Lookup l1 descriptor. */ 610 if (!get_level1_table_address(env, ptw->in_mmu_idx, &table, address)) { 611 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 612 fi->type = ARMFault_Translation; 613 goto do_fault; 614 } 615 if (!S1_ptw_translate(env, ptw, table, fi)) { 616 goto do_fault; 617 } 618 desc = arm_ldl_ptw(env, ptw, fi); 619 if (fi->type != ARMFault_None) { 620 goto do_fault; 621 } 622 type = (desc & 3); 623 domain = (desc >> 5) & 0x0f; 624 if (regime_el(env, ptw->in_mmu_idx) == 1) { 625 dacr = env->cp15.dacr_ns; 626 } else { 627 dacr = env->cp15.dacr_s; 628 } 629 domain_prot = (dacr >> (domain * 2)) & 3; 630 if (type == 0) { 631 /* Section translation fault. */ 632 fi->type = ARMFault_Translation; 633 goto do_fault; 634 } 635 if (type != 2) { 636 level = 2; 637 } 638 if (domain_prot == 0 || domain_prot == 2) { 639 fi->type = ARMFault_Domain; 640 goto do_fault; 641 } 642 if (type == 2) { 643 /* 1Mb section. */ 644 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 645 ap = (desc >> 10) & 3; 646 result->f.lg_page_size = 20; /* 1MB */ 647 } else { 648 /* Lookup l2 entry. */ 649 if (type == 1) { 650 /* Coarse pagetable. */ 651 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 652 } else { 653 /* Fine pagetable. */ 654 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc); 655 } 656 if (!S1_ptw_translate(env, ptw, table, fi)) { 657 goto do_fault; 658 } 659 desc = arm_ldl_ptw(env, ptw, fi); 660 if (fi->type != ARMFault_None) { 661 goto do_fault; 662 } 663 switch (desc & 3) { 664 case 0: /* Page translation fault. */ 665 fi->type = ARMFault_Translation; 666 goto do_fault; 667 case 1: /* 64k page. */ 668 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 669 ap = (desc >> (4 + ((address >> 13) & 6))) & 3; 670 result->f.lg_page_size = 16; 671 break; 672 case 2: /* 4k page. */ 673 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 674 ap = (desc >> (4 + ((address >> 9) & 6))) & 3; 675 result->f.lg_page_size = 12; 676 break; 677 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ 678 if (type == 1) { 679 /* ARMv6/XScale extended small page format */ 680 if (arm_feature(env, ARM_FEATURE_XSCALE) 681 || arm_feature(env, ARM_FEATURE_V6)) { 682 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 683 result->f.lg_page_size = 12; 684 } else { 685 /* 686 * UNPREDICTABLE in ARMv5; we choose to take a 687 * page translation fault. 688 */ 689 fi->type = ARMFault_Translation; 690 goto do_fault; 691 } 692 } else { 693 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); 694 result->f.lg_page_size = 10; 695 } 696 ap = (desc >> 4) & 3; 697 break; 698 default: 699 /* Never happens, but compiler isn't smart enough to tell. */ 700 g_assert_not_reached(); 701 } 702 } 703 result->f.prot = ap_to_rw_prot(env, ptw->in_mmu_idx, ap, domain_prot); 704 result->f.prot |= result->f.prot ? PAGE_EXEC : 0; 705 if (!(result->f.prot & (1 << access_type))) { 706 /* Access permission fault. */ 707 fi->type = ARMFault_Permission; 708 goto do_fault; 709 } 710 result->f.phys_addr = phys_addr; 711 return false; 712 do_fault: 713 fi->domain = domain; 714 fi->level = level; 715 return true; 716 } 717 718 static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw, 719 uint32_t address, MMUAccessType access_type, 720 GetPhysAddrResult *result, ARMMMUFaultInfo *fi) 721 { 722 ARMCPU *cpu = env_archcpu(env); 723 ARMMMUIdx mmu_idx = ptw->in_mmu_idx; 724 int level = 1; 725 uint32_t table; 726 uint32_t desc; 727 uint32_t xn; 728 uint32_t pxn = 0; 729 int type; 730 int ap; 731 int domain = 0; 732 int domain_prot; 733 hwaddr phys_addr; 734 uint32_t dacr; 735 bool ns; 736 int user_prot; 737 738 /* Pagetable walk. */ 739 /* Lookup l1 descriptor. */ 740 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 741 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 742 fi->type = ARMFault_Translation; 743 goto do_fault; 744 } 745 if (!S1_ptw_translate(env, ptw, table, fi)) { 746 goto do_fault; 747 } 748 desc = arm_ldl_ptw(env, ptw, fi); 749 if (fi->type != ARMFault_None) { 750 goto do_fault; 751 } 752 type = (desc & 3); 753 if (type == 0 || (type == 3 && !cpu_isar_feature(aa32_pxn, cpu))) { 754 /* Section translation fault, or attempt to use the encoding 755 * which is Reserved on implementations without PXN. 756 */ 757 fi->type = ARMFault_Translation; 758 goto do_fault; 759 } 760 if ((type == 1) || !(desc & (1 << 18))) { 761 /* Page or Section. */ 762 domain = (desc >> 5) & 0x0f; 763 } 764 if (regime_el(env, mmu_idx) == 1) { 765 dacr = env->cp15.dacr_ns; 766 } else { 767 dacr = env->cp15.dacr_s; 768 } 769 if (type == 1) { 770 level = 2; 771 } 772 domain_prot = (dacr >> (domain * 2)) & 3; 773 if (domain_prot == 0 || domain_prot == 2) { 774 /* Section or Page domain fault */ 775 fi->type = ARMFault_Domain; 776 goto do_fault; 777 } 778 if (type != 1) { 779 if (desc & (1 << 18)) { 780 /* Supersection. */ 781 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff); 782 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32; 783 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36; 784 result->f.lg_page_size = 24; /* 16MB */ 785 } else { 786 /* Section. */ 787 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 788 result->f.lg_page_size = 20; /* 1MB */ 789 } 790 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4); 791 xn = desc & (1 << 4); 792 pxn = desc & 1; 793 ns = extract32(desc, 19, 1); 794 } else { 795 if (cpu_isar_feature(aa32_pxn, cpu)) { 796 pxn = (desc >> 2) & 1; 797 } 798 ns = extract32(desc, 3, 1); 799 /* Lookup l2 entry. */ 800 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 801 if (!S1_ptw_translate(env, ptw, table, fi)) { 802 goto do_fault; 803 } 804 desc = arm_ldl_ptw(env, ptw, fi); 805 if (fi->type != ARMFault_None) { 806 goto do_fault; 807 } 808 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4); 809 switch (desc & 3) { 810 case 0: /* Page translation fault. */ 811 fi->type = ARMFault_Translation; 812 goto do_fault; 813 case 1: /* 64k page. */ 814 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 815 xn = desc & (1 << 15); 816 result->f.lg_page_size = 16; 817 break; 818 case 2: case 3: /* 4k page. */ 819 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 820 xn = desc & 1; 821 result->f.lg_page_size = 12; 822 break; 823 default: 824 /* Never happens, but compiler isn't smart enough to tell. */ 825 g_assert_not_reached(); 826 } 827 } 828 if (domain_prot == 3) { 829 result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 830 } else { 831 if (pxn && !regime_is_user(env, mmu_idx)) { 832 xn = 1; 833 } 834 if (xn && access_type == MMU_INST_FETCH) { 835 fi->type = ARMFault_Permission; 836 goto do_fault; 837 } 838 839 if (arm_feature(env, ARM_FEATURE_V6K) && 840 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) { 841 /* The simplified model uses AP[0] as an access control bit. */ 842 if ((ap & 1) == 0) { 843 /* Access flag fault. */ 844 fi->type = ARMFault_AccessFlag; 845 goto do_fault; 846 } 847 result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1); 848 user_prot = simple_ap_to_rw_prot_is_user(ap >> 1, 1); 849 } else { 850 result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 851 user_prot = ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot, 1); 852 } 853 if (result->f.prot && !xn) { 854 result->f.prot |= PAGE_EXEC; 855 } 856 if (!(result->f.prot & (1 << access_type))) { 857 /* Access permission fault. */ 858 fi->type = ARMFault_Permission; 859 goto do_fault; 860 } 861 if (regime_is_pan(env, mmu_idx) && 862 !regime_is_user(env, mmu_idx) && 863 user_prot && 864 access_type != MMU_INST_FETCH) { 865 /* Privileged Access Never fault */ 866 fi->type = ARMFault_Permission; 867 goto do_fault; 868 } 869 } 870 if (ns) { 871 /* The NS bit will (as required by the architecture) have no effect if 872 * the CPU doesn't support TZ or this is a non-secure translation 873 * regime, because the attribute will already be non-secure. 874 */ 875 result->f.attrs.secure = false; 876 } 877 result->f.phys_addr = phys_addr; 878 return false; 879 do_fault: 880 fi->domain = domain; 881 fi->level = level; 882 return true; 883 } 884 885 /* 886 * Translate S2 section/page access permissions to protection flags 887 * @env: CPUARMState 888 * @s2ap: The 2-bit stage2 access permissions (S2AP) 889 * @xn: XN (execute-never) bits 890 * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0 891 */ 892 static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0) 893 { 894 int prot = 0; 895 896 if (s2ap & 1) { 897 prot |= PAGE_READ; 898 } 899 if (s2ap & 2) { 900 prot |= PAGE_WRITE; 901 } 902 903 if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) { 904 switch (xn) { 905 case 0: 906 prot |= PAGE_EXEC; 907 break; 908 case 1: 909 if (s1_is_el0) { 910 prot |= PAGE_EXEC; 911 } 912 break; 913 case 2: 914 break; 915 case 3: 916 if (!s1_is_el0) { 917 prot |= PAGE_EXEC; 918 } 919 break; 920 default: 921 g_assert_not_reached(); 922 } 923 } else { 924 if (!extract32(xn, 1, 1)) { 925 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) { 926 prot |= PAGE_EXEC; 927 } 928 } 929 } 930 return prot; 931 } 932 933 /* 934 * Translate section/page access permissions to protection flags 935 * @env: CPUARMState 936 * @mmu_idx: MMU index indicating required translation regime 937 * @is_aa64: TRUE if AArch64 938 * @ap: The 2-bit simple AP (AP[2:1]) 939 * @ns: NS (non-secure) bit 940 * @xn: XN (execute-never) bit 941 * @pxn: PXN (privileged execute-never) bit 942 */ 943 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64, 944 int ap, int ns, int xn, int pxn) 945 { 946 bool is_user = regime_is_user(env, mmu_idx); 947 int prot_rw, user_rw; 948 bool have_wxn; 949 int wxn = 0; 950 951 assert(!regime_is_stage2(mmu_idx)); 952 953 user_rw = simple_ap_to_rw_prot_is_user(ap, true); 954 if (is_user) { 955 prot_rw = user_rw; 956 } else { 957 if (user_rw && regime_is_pan(env, mmu_idx)) { 958 /* PAN forbids data accesses but doesn't affect insn fetch */ 959 prot_rw = 0; 960 } else { 961 prot_rw = simple_ap_to_rw_prot_is_user(ap, false); 962 } 963 } 964 965 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) { 966 return prot_rw; 967 } 968 969 /* TODO have_wxn should be replaced with 970 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2) 971 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE 972 * compatible processors have EL2, which is required for [U]WXN. 973 */ 974 have_wxn = arm_feature(env, ARM_FEATURE_LPAE); 975 976 if (have_wxn) { 977 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN; 978 } 979 980 if (is_aa64) { 981 if (regime_has_2_ranges(mmu_idx) && !is_user) { 982 xn = pxn || (user_rw & PAGE_WRITE); 983 } 984 } else if (arm_feature(env, ARM_FEATURE_V7)) { 985 switch (regime_el(env, mmu_idx)) { 986 case 1: 987 case 3: 988 if (is_user) { 989 xn = xn || !(user_rw & PAGE_READ); 990 } else { 991 int uwxn = 0; 992 if (have_wxn) { 993 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN; 994 } 995 xn = xn || !(prot_rw & PAGE_READ) || pxn || 996 (uwxn && (user_rw & PAGE_WRITE)); 997 } 998 break; 999 case 2: 1000 break; 1001 } 1002 } else { 1003 xn = wxn = 0; 1004 } 1005 1006 if (xn || (wxn && (prot_rw & PAGE_WRITE))) { 1007 return prot_rw; 1008 } 1009 return prot_rw | PAGE_EXEC; 1010 } 1011 1012 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va, 1013 ARMMMUIdx mmu_idx) 1014 { 1015 uint64_t tcr = regime_tcr(env, mmu_idx); 1016 uint32_t el = regime_el(env, mmu_idx); 1017 int select, tsz; 1018 bool epd, hpd; 1019 1020 assert(mmu_idx != ARMMMUIdx_Stage2_S); 1021 1022 if (mmu_idx == ARMMMUIdx_Stage2) { 1023 /* VTCR */ 1024 bool sext = extract32(tcr, 4, 1); 1025 bool sign = extract32(tcr, 3, 1); 1026 1027 /* 1028 * If the sign-extend bit is not the same as t0sz[3], the result 1029 * is unpredictable. Flag this as a guest error. 1030 */ 1031 if (sign != sext) { 1032 qemu_log_mask(LOG_GUEST_ERROR, 1033 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n"); 1034 } 1035 tsz = sextract32(tcr, 0, 4) + 8; 1036 select = 0; 1037 hpd = false; 1038 epd = false; 1039 } else if (el == 2) { 1040 /* HTCR */ 1041 tsz = extract32(tcr, 0, 3); 1042 select = 0; 1043 hpd = extract64(tcr, 24, 1); 1044 epd = false; 1045 } else { 1046 int t0sz = extract32(tcr, 0, 3); 1047 int t1sz = extract32(tcr, 16, 3); 1048 1049 if (t1sz == 0) { 1050 select = va > (0xffffffffu >> t0sz); 1051 } else { 1052 /* Note that we will detect errors later. */ 1053 select = va >= ~(0xffffffffu >> t1sz); 1054 } 1055 if (!select) { 1056 tsz = t0sz; 1057 epd = extract32(tcr, 7, 1); 1058 hpd = extract64(tcr, 41, 1); 1059 } else { 1060 tsz = t1sz; 1061 epd = extract32(tcr, 23, 1); 1062 hpd = extract64(tcr, 42, 1); 1063 } 1064 /* For aarch32, hpd0 is not enabled without t2e as well. */ 1065 hpd &= extract32(tcr, 6, 1); 1066 } 1067 1068 return (ARMVAParameters) { 1069 .tsz = tsz, 1070 .select = select, 1071 .epd = epd, 1072 .hpd = hpd, 1073 }; 1074 } 1075 1076 /* 1077 * check_s2_mmu_setup 1078 * @cpu: ARMCPU 1079 * @is_aa64: True if the translation regime is in AArch64 state 1080 * @startlevel: Suggested starting level 1081 * @inputsize: Bitsize of IPAs 1082 * @stride: Page-table stride (See the ARM ARM) 1083 * 1084 * Returns true if the suggested S2 translation parameters are OK and 1085 * false otherwise. 1086 */ 1087 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level, 1088 int inputsize, int stride, int outputsize) 1089 { 1090 const int grainsize = stride + 3; 1091 int startsizecheck; 1092 1093 /* 1094 * Negative levels are usually not allowed... 1095 * Except for FEAT_LPA2, 4k page table, 52-bit address space, which 1096 * begins with level -1. Note that previous feature tests will have 1097 * eliminated this combination if it is not enabled. 1098 */ 1099 if (level < (inputsize == 52 && stride == 9 ? -1 : 0)) { 1100 return false; 1101 } 1102 1103 startsizecheck = inputsize - ((3 - level) * stride + grainsize); 1104 if (startsizecheck < 1 || startsizecheck > stride + 4) { 1105 return false; 1106 } 1107 1108 if (is_aa64) { 1109 switch (stride) { 1110 case 13: /* 64KB Pages. */ 1111 if (level == 0 || (level == 1 && outputsize <= 42)) { 1112 return false; 1113 } 1114 break; 1115 case 11: /* 16KB Pages. */ 1116 if (level == 0 || (level == 1 && outputsize <= 40)) { 1117 return false; 1118 } 1119 break; 1120 case 9: /* 4KB Pages. */ 1121 if (level == 0 && outputsize <= 42) { 1122 return false; 1123 } 1124 break; 1125 default: 1126 g_assert_not_reached(); 1127 } 1128 1129 /* Inputsize checks. */ 1130 if (inputsize > outputsize && 1131 (arm_el_is_aa64(&cpu->env, 1) || inputsize > 40)) { 1132 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */ 1133 return false; 1134 } 1135 } else { 1136 /* AArch32 only supports 4KB pages. Assert on that. */ 1137 assert(stride == 9); 1138 1139 if (level == 0) { 1140 return false; 1141 } 1142 } 1143 return true; 1144 } 1145 1146 /** 1147 * get_phys_addr_lpae: perform one stage of page table walk, LPAE format 1148 * 1149 * Returns false if the translation was successful. Otherwise, phys_ptr, 1150 * attrs, prot and page_size may not be filled in, and the populated fsr 1151 * value provides information on why the translation aborted, in the format 1152 * of a long-format DFSR/IFSR fault register, with the following caveat: 1153 * the WnR bit is never set (the caller must do this). 1154 * 1155 * @env: CPUARMState 1156 * @ptw: Current and next stage parameters for the walk. 1157 * @address: virtual address to get physical address for 1158 * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH 1159 * @s1_is_el0: if @ptw->in_mmu_idx is ARMMMUIdx_Stage2 1160 * (so this is a stage 2 page table walk), 1161 * must be true if this is stage 2 of a stage 1+2 1162 * walk for an EL0 access. If @mmu_idx is anything else, 1163 * @s1_is_el0 is ignored. 1164 * @result: set on translation success, 1165 * @fi: set to fault info if the translation fails 1166 */ 1167 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, 1168 uint64_t address, 1169 MMUAccessType access_type, bool s1_is_el0, 1170 GetPhysAddrResult *result, ARMMMUFaultInfo *fi) 1171 { 1172 ARMCPU *cpu = env_archcpu(env); 1173 ARMMMUIdx mmu_idx = ptw->in_mmu_idx; 1174 bool is_secure = ptw->in_secure; 1175 uint32_t level; 1176 ARMVAParameters param; 1177 uint64_t ttbr; 1178 hwaddr descaddr, indexmask, indexmask_grainsize; 1179 uint32_t tableattrs; 1180 target_ulong page_size; 1181 uint64_t attrs; 1182 int32_t stride; 1183 int addrsize, inputsize, outputsize; 1184 uint64_t tcr = regime_tcr(env, mmu_idx); 1185 int ap, ns, xn, pxn; 1186 uint32_t el = regime_el(env, mmu_idx); 1187 uint64_t descaddrmask; 1188 bool aarch64 = arm_el_is_aa64(env, el); 1189 uint64_t descriptor, new_descriptor; 1190 bool nstable; 1191 1192 /* TODO: This code does not support shareability levels. */ 1193 if (aarch64) { 1194 int ps; 1195 1196 param = aa64_va_parameters(env, address, mmu_idx, 1197 access_type != MMU_INST_FETCH); 1198 level = 0; 1199 1200 /* 1201 * If TxSZ is programmed to a value larger than the maximum, 1202 * or smaller than the effective minimum, it is IMPLEMENTATION 1203 * DEFINED whether we behave as if the field were programmed 1204 * within bounds, or if a level 0 Translation fault is generated. 1205 * 1206 * With FEAT_LVA, fault on less than minimum becomes required, 1207 * so our choice is to always raise the fault. 1208 */ 1209 if (param.tsz_oob) { 1210 goto do_translation_fault; 1211 } 1212 1213 addrsize = 64 - 8 * param.tbi; 1214 inputsize = 64 - param.tsz; 1215 1216 /* 1217 * Bound PS by PARANGE to find the effective output address size. 1218 * ID_AA64MMFR0 is a read-only register so values outside of the 1219 * supported mappings can be considered an implementation error. 1220 */ 1221 ps = FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE); 1222 ps = MIN(ps, param.ps); 1223 assert(ps < ARRAY_SIZE(pamax_map)); 1224 outputsize = pamax_map[ps]; 1225 } else { 1226 param = aa32_va_parameters(env, address, mmu_idx); 1227 level = 1; 1228 addrsize = (mmu_idx == ARMMMUIdx_Stage2 ? 40 : 32); 1229 inputsize = addrsize - param.tsz; 1230 outputsize = 40; 1231 } 1232 1233 /* 1234 * We determined the region when collecting the parameters, but we 1235 * have not yet validated that the address is valid for the region. 1236 * Extract the top bits and verify that they all match select. 1237 * 1238 * For aa32, if inputsize == addrsize, then we have selected the 1239 * region by exclusion in aa32_va_parameters and there is no more 1240 * validation to do here. 1241 */ 1242 if (inputsize < addrsize) { 1243 target_ulong top_bits = sextract64(address, inputsize, 1244 addrsize - inputsize); 1245 if (-top_bits != param.select) { 1246 /* The gap between the two regions is a Translation fault */ 1247 goto do_translation_fault; 1248 } 1249 } 1250 1251 stride = arm_granule_bits(param.gran) - 3; 1252 1253 /* 1254 * Note that QEMU ignores shareability and cacheability attributes, 1255 * so we don't need to do anything with the SH, ORGN, IRGN fields 1256 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the 1257 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently 1258 * implement any ASID-like capability so we can ignore it (instead 1259 * we will always flush the TLB any time the ASID is changed). 1260 */ 1261 ttbr = regime_ttbr(env, mmu_idx, param.select); 1262 1263 /* 1264 * Here we should have set up all the parameters for the translation: 1265 * inputsize, ttbr, epd, stride, tbi 1266 */ 1267 1268 if (param.epd) { 1269 /* 1270 * Translation table walk disabled => Translation fault on TLB miss 1271 * Note: This is always 0 on 64-bit EL2 and EL3. 1272 */ 1273 goto do_translation_fault; 1274 } 1275 1276 if (!regime_is_stage2(mmu_idx)) { 1277 /* 1278 * The starting level depends on the virtual address size (which can 1279 * be up to 48 bits) and the translation granule size. It indicates 1280 * the number of strides (stride bits at a time) needed to 1281 * consume the bits of the input address. In the pseudocode this is: 1282 * level = 4 - RoundUp((inputsize - grainsize) / stride) 1283 * where their 'inputsize' is our 'inputsize', 'grainsize' is 1284 * our 'stride + 3' and 'stride' is our 'stride'. 1285 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying: 1286 * = 4 - (inputsize - stride - 3 + stride - 1) / stride 1287 * = 4 - (inputsize - 4) / stride; 1288 */ 1289 level = 4 - (inputsize - 4) / stride; 1290 } else { 1291 /* 1292 * For stage 2 translations the starting level is specified by the 1293 * VTCR_EL2.SL0 field (whose interpretation depends on the page size) 1294 */ 1295 uint32_t sl0 = extract32(tcr, 6, 2); 1296 uint32_t sl2 = extract64(tcr, 33, 1); 1297 uint32_t startlevel; 1298 bool ok; 1299 1300 /* SL2 is RES0 unless DS=1 & 4kb granule. */ 1301 if (param.ds && stride == 9 && sl2) { 1302 if (sl0 != 0) { 1303 level = 0; 1304 goto do_translation_fault; 1305 } 1306 startlevel = -1; 1307 } else if (!aarch64 || stride == 9) { 1308 /* AArch32 or 4KB pages */ 1309 startlevel = 2 - sl0; 1310 1311 if (cpu_isar_feature(aa64_st, cpu)) { 1312 startlevel &= 3; 1313 } 1314 } else { 1315 /* 16KB or 64KB pages */ 1316 startlevel = 3 - sl0; 1317 } 1318 1319 /* Check that the starting level is valid. */ 1320 ok = check_s2_mmu_setup(cpu, aarch64, startlevel, 1321 inputsize, stride, outputsize); 1322 if (!ok) { 1323 goto do_translation_fault; 1324 } 1325 level = startlevel; 1326 } 1327 1328 indexmask_grainsize = MAKE_64BIT_MASK(0, stride + 3); 1329 indexmask = MAKE_64BIT_MASK(0, inputsize - (stride * (4 - level))); 1330 1331 /* Now we can extract the actual base address from the TTBR */ 1332 descaddr = extract64(ttbr, 0, 48); 1333 1334 /* 1335 * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR. 1336 * 1337 * Otherwise, if the base address is out of range, raise AddressSizeFault. 1338 * In the pseudocode, this is !IsZero(baseregister<47:outputsize>), 1339 * but we've just cleared the bits above 47, so simplify the test. 1340 */ 1341 if (outputsize > 48) { 1342 descaddr |= extract64(ttbr, 2, 4) << 48; 1343 } else if (descaddr >> outputsize) { 1344 level = 0; 1345 fi->type = ARMFault_AddressSize; 1346 goto do_fault; 1347 } 1348 1349 /* 1350 * We rely on this masking to clear the RES0 bits at the bottom of the TTBR 1351 * and also to mask out CnP (bit 0) which could validly be non-zero. 1352 */ 1353 descaddr &= ~indexmask; 1354 1355 /* 1356 * For AArch32, the address field in the descriptor goes up to bit 39 1357 * for both v7 and v8. However, for v8 the SBZ bits [47:40] must be 0 1358 * or an AddressSize fault is raised. So for v8 we extract those SBZ 1359 * bits as part of the address, which will be checked via outputsize. 1360 * For AArch64, the address field goes up to bit 47, or 49 with FEAT_LPA2; 1361 * the highest bits of a 52-bit output are placed elsewhere. 1362 */ 1363 if (param.ds) { 1364 descaddrmask = MAKE_64BIT_MASK(0, 50); 1365 } else if (arm_feature(env, ARM_FEATURE_V8)) { 1366 descaddrmask = MAKE_64BIT_MASK(0, 48); 1367 } else { 1368 descaddrmask = MAKE_64BIT_MASK(0, 40); 1369 } 1370 descaddrmask &= ~indexmask_grainsize; 1371 1372 /* 1373 * Secure accesses start with the page table in secure memory and 1374 * can be downgraded to non-secure at any step. Non-secure accesses 1375 * remain non-secure. We implement this by just ORing in the NSTable/NS 1376 * bits at each step. 1377 */ 1378 tableattrs = is_secure ? 0 : (1 << 4); 1379 1380 next_level: 1381 descaddr |= (address >> (stride * (4 - level))) & indexmask; 1382 descaddr &= ~7ULL; 1383 nstable = extract32(tableattrs, 4, 1); 1384 if (nstable) { 1385 /* 1386 * Stage2_S -> Stage2 or Phys_S -> Phys_NS 1387 * Assert that the non-secure idx are even, and relative order. 1388 */ 1389 QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0); 1390 QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0); 1391 QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S); 1392 QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S); 1393 ptw->in_ptw_idx &= ~1; 1394 ptw->in_secure = false; 1395 } 1396 if (!S1_ptw_translate(env, ptw, descaddr, fi)) { 1397 goto do_fault; 1398 } 1399 descriptor = arm_ldq_ptw(env, ptw, fi); 1400 if (fi->type != ARMFault_None) { 1401 goto do_fault; 1402 } 1403 new_descriptor = descriptor; 1404 1405 restart_atomic_update: 1406 if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) { 1407 /* Invalid, or the Reserved level 3 encoding */ 1408 goto do_translation_fault; 1409 } 1410 1411 descaddr = descriptor & descaddrmask; 1412 1413 /* 1414 * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12] 1415 * of descriptor. For FEAT_LPA2 and effective DS, bits [51:50] of 1416 * descaddr are in [9:8]. Otherwise, if descaddr is out of range, 1417 * raise AddressSizeFault. 1418 */ 1419 if (outputsize > 48) { 1420 if (param.ds) { 1421 descaddr |= extract64(descriptor, 8, 2) << 50; 1422 } else { 1423 descaddr |= extract64(descriptor, 12, 4) << 48; 1424 } 1425 } else if (descaddr >> outputsize) { 1426 fi->type = ARMFault_AddressSize; 1427 goto do_fault; 1428 } 1429 1430 if ((descriptor & 2) && (level < 3)) { 1431 /* 1432 * Table entry. The top five bits are attributes which may 1433 * propagate down through lower levels of the table (and 1434 * which are all arranged so that 0 means "no effect", so 1435 * we can gather them up by ORing in the bits at each level). 1436 */ 1437 tableattrs |= extract64(descriptor, 59, 5); 1438 level++; 1439 indexmask = indexmask_grainsize; 1440 goto next_level; 1441 } 1442 1443 /* 1444 * Block entry at level 1 or 2, or page entry at level 3. 1445 * These are basically the same thing, although the number 1446 * of bits we pull in from the vaddr varies. Note that although 1447 * descaddrmask masks enough of the low bits of the descriptor 1448 * to give a correct page or table address, the address field 1449 * in a block descriptor is smaller; so we need to explicitly 1450 * clear the lower bits here before ORing in the low vaddr bits. 1451 * 1452 * Afterward, descaddr is the final physical address. 1453 */ 1454 page_size = (1ULL << ((stride * (4 - level)) + 3)); 1455 descaddr &= ~(hwaddr)(page_size - 1); 1456 descaddr |= (address & (page_size - 1)); 1457 1458 if (likely(!ptw->in_debug)) { 1459 /* 1460 * Access flag. 1461 * If HA is enabled, prepare to update the descriptor below. 1462 * Otherwise, pass the access fault on to software. 1463 */ 1464 if (!(descriptor & (1 << 10))) { 1465 if (param.ha) { 1466 new_descriptor |= 1 << 10; /* AF */ 1467 } else { 1468 fi->type = ARMFault_AccessFlag; 1469 goto do_fault; 1470 } 1471 } 1472 1473 /* 1474 * Dirty Bit. 1475 * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP 1476 * bit for writeback. The actual write protection test may still be 1477 * overridden by tableattrs, to be merged below. 1478 */ 1479 if (param.hd 1480 && extract64(descriptor, 51, 1) /* DBM */ 1481 && access_type == MMU_DATA_STORE) { 1482 if (regime_is_stage2(mmu_idx)) { 1483 new_descriptor |= 1ull << 7; /* set S2AP[1] */ 1484 } else { 1485 new_descriptor &= ~(1ull << 7); /* clear AP[2] */ 1486 } 1487 } 1488 } 1489 1490 /* 1491 * Extract attributes from the (modified) descriptor, and apply 1492 * table descriptors. Stage 2 table descriptors do not include 1493 * any attribute fields. HPD disables all the table attributes 1494 * except NSTable. 1495 */ 1496 attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14)); 1497 if (!regime_is_stage2(mmu_idx)) { 1498 attrs |= nstable << 5; /* NS */ 1499 if (!param.hpd) { 1500 attrs |= extract64(tableattrs, 0, 2) << 53; /* XN, PXN */ 1501 /* 1502 * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1 1503 * means "force PL1 access only", which means forcing AP[1] to 0. 1504 */ 1505 attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */ 1506 attrs |= extract32(tableattrs, 3, 1) << 7; /* APT[1] => AP[2] */ 1507 } 1508 } 1509 1510 ap = extract32(attrs, 6, 2); 1511 if (regime_is_stage2(mmu_idx)) { 1512 ns = mmu_idx == ARMMMUIdx_Stage2; 1513 xn = extract64(attrs, 53, 2); 1514 result->f.prot = get_S2prot(env, ap, xn, s1_is_el0); 1515 } else { 1516 ns = extract32(attrs, 5, 1); 1517 xn = extract64(attrs, 54, 1); 1518 pxn = extract64(attrs, 53, 1); 1519 result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn); 1520 } 1521 1522 if (!(result->f.prot & (1 << access_type))) { 1523 fi->type = ARMFault_Permission; 1524 goto do_fault; 1525 } 1526 1527 /* If FEAT_HAFDBS has made changes, update the PTE. */ 1528 if (new_descriptor != descriptor) { 1529 new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi); 1530 if (fi->type != ARMFault_None) { 1531 goto do_fault; 1532 } 1533 /* 1534 * I_YZSVV says that if the in-memory descriptor has changed, 1535 * then we must use the information in that new value 1536 * (which might include a different output address, different 1537 * attributes, or generate a fault). 1538 * Restart the handling of the descriptor value from scratch. 1539 */ 1540 if (new_descriptor != descriptor) { 1541 descriptor = new_descriptor; 1542 goto restart_atomic_update; 1543 } 1544 } 1545 1546 if (ns) { 1547 /* 1548 * The NS bit will (as required by the architecture) have no effect if 1549 * the CPU doesn't support TZ or this is a non-secure translation 1550 * regime, because the attribute will already be non-secure. 1551 */ 1552 result->f.attrs.secure = false; 1553 } 1554 1555 /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */ 1556 if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) { 1557 result->f.guarded = extract64(attrs, 50, 1); /* GP */ 1558 } 1559 1560 if (regime_is_stage2(mmu_idx)) { 1561 result->cacheattrs.is_s2_format = true; 1562 result->cacheattrs.attrs = extract32(attrs, 2, 4); 1563 } else { 1564 /* Index into MAIR registers for cache attributes */ 1565 uint8_t attrindx = extract32(attrs, 2, 3); 1566 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)]; 1567 assert(attrindx <= 7); 1568 result->cacheattrs.is_s2_format = false; 1569 result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8); 1570 } 1571 1572 /* 1573 * For FEAT_LPA2 and effective DS, the SH field in the attributes 1574 * was re-purposed for output address bits. The SH attribute in 1575 * that case comes from TCR_ELx, which we extracted earlier. 1576 */ 1577 if (param.ds) { 1578 result->cacheattrs.shareability = param.sh; 1579 } else { 1580 result->cacheattrs.shareability = extract32(attrs, 8, 2); 1581 } 1582 1583 result->f.phys_addr = descaddr; 1584 result->f.lg_page_size = ctz64(page_size); 1585 return false; 1586 1587 do_translation_fault: 1588 fi->type = ARMFault_Translation; 1589 do_fault: 1590 fi->level = level; 1591 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */ 1592 fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx); 1593 fi->s1ns = mmu_idx == ARMMMUIdx_Stage2; 1594 return true; 1595 } 1596 1597 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, 1598 MMUAccessType access_type, ARMMMUIdx mmu_idx, 1599 bool is_secure, GetPhysAddrResult *result, 1600 ARMMMUFaultInfo *fi) 1601 { 1602 int n; 1603 uint32_t mask; 1604 uint32_t base; 1605 bool is_user = regime_is_user(env, mmu_idx); 1606 1607 if (regime_translation_disabled(env, mmu_idx, is_secure)) { 1608 /* MPU disabled. */ 1609 result->f.phys_addr = address; 1610 result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 1611 return false; 1612 } 1613 1614 result->f.phys_addr = address; 1615 for (n = 7; n >= 0; n--) { 1616 base = env->cp15.c6_region[n]; 1617 if ((base & 1) == 0) { 1618 continue; 1619 } 1620 mask = 1 << ((base >> 1) & 0x1f); 1621 /* Keep this shift separate from the above to avoid an 1622 (undefined) << 32. */ 1623 mask = (mask << 1) - 1; 1624 if (((base ^ address) & ~mask) == 0) { 1625 break; 1626 } 1627 } 1628 if (n < 0) { 1629 fi->type = ARMFault_Background; 1630 return true; 1631 } 1632 1633 if (access_type == MMU_INST_FETCH) { 1634 mask = env->cp15.pmsav5_insn_ap; 1635 } else { 1636 mask = env->cp15.pmsav5_data_ap; 1637 } 1638 mask = (mask >> (n * 4)) & 0xf; 1639 switch (mask) { 1640 case 0: 1641 fi->type = ARMFault_Permission; 1642 fi->level = 1; 1643 return true; 1644 case 1: 1645 if (is_user) { 1646 fi->type = ARMFault_Permission; 1647 fi->level = 1; 1648 return true; 1649 } 1650 result->f.prot = PAGE_READ | PAGE_WRITE; 1651 break; 1652 case 2: 1653 result->f.prot = PAGE_READ; 1654 if (!is_user) { 1655 result->f.prot |= PAGE_WRITE; 1656 } 1657 break; 1658 case 3: 1659 result->f.prot = PAGE_READ | PAGE_WRITE; 1660 break; 1661 case 5: 1662 if (is_user) { 1663 fi->type = ARMFault_Permission; 1664 fi->level = 1; 1665 return true; 1666 } 1667 result->f.prot = PAGE_READ; 1668 break; 1669 case 6: 1670 result->f.prot = PAGE_READ; 1671 break; 1672 default: 1673 /* Bad permission. */ 1674 fi->type = ARMFault_Permission; 1675 fi->level = 1; 1676 return true; 1677 } 1678 result->f.prot |= PAGE_EXEC; 1679 return false; 1680 } 1681 1682 static void get_phys_addr_pmsav7_default(CPUARMState *env, ARMMMUIdx mmu_idx, 1683 int32_t address, uint8_t *prot) 1684 { 1685 if (!arm_feature(env, ARM_FEATURE_M)) { 1686 *prot = PAGE_READ | PAGE_WRITE; 1687 switch (address) { 1688 case 0xF0000000 ... 0xFFFFFFFF: 1689 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { 1690 /* hivecs execing is ok */ 1691 *prot |= PAGE_EXEC; 1692 } 1693 break; 1694 case 0x00000000 ... 0x7FFFFFFF: 1695 *prot |= PAGE_EXEC; 1696 break; 1697 } 1698 } else { 1699 /* Default system address map for M profile cores. 1700 * The architecture specifies which regions are execute-never; 1701 * at the MPU level no other checks are defined. 1702 */ 1703 switch (address) { 1704 case 0x00000000 ... 0x1fffffff: /* ROM */ 1705 case 0x20000000 ... 0x3fffffff: /* SRAM */ 1706 case 0x60000000 ... 0x7fffffff: /* RAM */ 1707 case 0x80000000 ... 0x9fffffff: /* RAM */ 1708 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 1709 break; 1710 case 0x40000000 ... 0x5fffffff: /* Peripheral */ 1711 case 0xa0000000 ... 0xbfffffff: /* Device */ 1712 case 0xc0000000 ... 0xdfffffff: /* Device */ 1713 case 0xe0000000 ... 0xffffffff: /* System */ 1714 *prot = PAGE_READ | PAGE_WRITE; 1715 break; 1716 default: 1717 g_assert_not_reached(); 1718 } 1719 } 1720 } 1721 1722 static bool m_is_ppb_region(CPUARMState *env, uint32_t address) 1723 { 1724 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */ 1725 return arm_feature(env, ARM_FEATURE_M) && 1726 extract32(address, 20, 12) == 0xe00; 1727 } 1728 1729 static bool m_is_system_region(CPUARMState *env, uint32_t address) 1730 { 1731 /* 1732 * True if address is in the M profile system region 1733 * 0xe0000000 - 0xffffffff 1734 */ 1735 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7; 1736 } 1737 1738 static bool pmsav7_use_background_region(ARMCPU *cpu, ARMMMUIdx mmu_idx, 1739 bool is_secure, bool is_user) 1740 { 1741 /* 1742 * Return true if we should use the default memory map as a 1743 * "background" region if there are no hits against any MPU regions. 1744 */ 1745 CPUARMState *env = &cpu->env; 1746 1747 if (is_user) { 1748 return false; 1749 } 1750 1751 if (arm_feature(env, ARM_FEATURE_M)) { 1752 return env->v7m.mpu_ctrl[is_secure] & R_V7M_MPU_CTRL_PRIVDEFENA_MASK; 1753 } else { 1754 return regime_sctlr(env, mmu_idx) & SCTLR_BR; 1755 } 1756 } 1757 1758 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, 1759 MMUAccessType access_type, ARMMMUIdx mmu_idx, 1760 bool secure, GetPhysAddrResult *result, 1761 ARMMMUFaultInfo *fi) 1762 { 1763 ARMCPU *cpu = env_archcpu(env); 1764 int n; 1765 bool is_user = regime_is_user(env, mmu_idx); 1766 1767 result->f.phys_addr = address; 1768 result->f.lg_page_size = TARGET_PAGE_BITS; 1769 result->f.prot = 0; 1770 1771 if (regime_translation_disabled(env, mmu_idx, secure) || 1772 m_is_ppb_region(env, address)) { 1773 /* 1774 * MPU disabled or M profile PPB access: use default memory map. 1775 * The other case which uses the default memory map in the 1776 * v7M ARM ARM pseudocode is exception vector reads from the vector 1777 * table. In QEMU those accesses are done in arm_v7m_load_vector(), 1778 * which always does a direct read using address_space_ldl(), rather 1779 * than going via this function, so we don't need to check that here. 1780 */ 1781 get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot); 1782 } else { /* MPU enabled */ 1783 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 1784 /* region search */ 1785 uint32_t base = env->pmsav7.drbar[n]; 1786 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5); 1787 uint32_t rmask; 1788 bool srdis = false; 1789 1790 if (!(env->pmsav7.drsr[n] & 0x1)) { 1791 continue; 1792 } 1793 1794 if (!rsize) { 1795 qemu_log_mask(LOG_GUEST_ERROR, 1796 "DRSR[%d]: Rsize field cannot be 0\n", n); 1797 continue; 1798 } 1799 rsize++; 1800 rmask = (1ull << rsize) - 1; 1801 1802 if (base & rmask) { 1803 qemu_log_mask(LOG_GUEST_ERROR, 1804 "DRBAR[%d]: 0x%" PRIx32 " misaligned " 1805 "to DRSR region size, mask = 0x%" PRIx32 "\n", 1806 n, base, rmask); 1807 continue; 1808 } 1809 1810 if (address < base || address > base + rmask) { 1811 /* 1812 * Address not in this region. We must check whether the 1813 * region covers addresses in the same page as our address. 1814 * In that case we must not report a size that covers the 1815 * whole page for a subsequent hit against a different MPU 1816 * region or the background region, because it would result in 1817 * incorrect TLB hits for subsequent accesses to addresses that 1818 * are in this MPU region. 1819 */ 1820 if (ranges_overlap(base, rmask, 1821 address & TARGET_PAGE_MASK, 1822 TARGET_PAGE_SIZE)) { 1823 result->f.lg_page_size = 0; 1824 } 1825 continue; 1826 } 1827 1828 /* Region matched */ 1829 1830 if (rsize >= 8) { /* no subregions for regions < 256 bytes */ 1831 int i, snd; 1832 uint32_t srdis_mask; 1833 1834 rsize -= 3; /* sub region size (power of 2) */ 1835 snd = ((address - base) >> rsize) & 0x7; 1836 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1); 1837 1838 srdis_mask = srdis ? 0x3 : 0x0; 1839 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) { 1840 /* 1841 * This will check in groups of 2, 4 and then 8, whether 1842 * the subregion bits are consistent. rsize is incremented 1843 * back up to give the region size, considering consistent 1844 * adjacent subregions as one region. Stop testing if rsize 1845 * is already big enough for an entire QEMU page. 1846 */ 1847 int snd_rounded = snd & ~(i - 1); 1848 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n], 1849 snd_rounded + 8, i); 1850 if (srdis_mask ^ srdis_multi) { 1851 break; 1852 } 1853 srdis_mask = (srdis_mask << i) | srdis_mask; 1854 rsize++; 1855 } 1856 } 1857 if (srdis) { 1858 continue; 1859 } 1860 if (rsize < TARGET_PAGE_BITS) { 1861 result->f.lg_page_size = rsize; 1862 } 1863 break; 1864 } 1865 1866 if (n == -1) { /* no hits */ 1867 if (!pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) { 1868 /* background fault */ 1869 fi->type = ARMFault_Background; 1870 return true; 1871 } 1872 get_phys_addr_pmsav7_default(env, mmu_idx, address, 1873 &result->f.prot); 1874 } else { /* a MPU hit! */ 1875 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3); 1876 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1); 1877 1878 if (m_is_system_region(env, address)) { 1879 /* System space is always execute never */ 1880 xn = 1; 1881 } 1882 1883 if (is_user) { /* User mode AP bit decoding */ 1884 switch (ap) { 1885 case 0: 1886 case 1: 1887 case 5: 1888 break; /* no access */ 1889 case 3: 1890 result->f.prot |= PAGE_WRITE; 1891 /* fall through */ 1892 case 2: 1893 case 6: 1894 result->f.prot |= PAGE_READ | PAGE_EXEC; 1895 break; 1896 case 7: 1897 /* for v7M, same as 6; for R profile a reserved value */ 1898 if (arm_feature(env, ARM_FEATURE_M)) { 1899 result->f.prot |= PAGE_READ | PAGE_EXEC; 1900 break; 1901 } 1902 /* fall through */ 1903 default: 1904 qemu_log_mask(LOG_GUEST_ERROR, 1905 "DRACR[%d]: Bad value for AP bits: 0x%" 1906 PRIx32 "\n", n, ap); 1907 } 1908 } else { /* Priv. mode AP bits decoding */ 1909 switch (ap) { 1910 case 0: 1911 break; /* no access */ 1912 case 1: 1913 case 2: 1914 case 3: 1915 result->f.prot |= PAGE_WRITE; 1916 /* fall through */ 1917 case 5: 1918 case 6: 1919 result->f.prot |= PAGE_READ | PAGE_EXEC; 1920 break; 1921 case 7: 1922 /* for v7M, same as 6; for R profile a reserved value */ 1923 if (arm_feature(env, ARM_FEATURE_M)) { 1924 result->f.prot |= PAGE_READ | PAGE_EXEC; 1925 break; 1926 } 1927 /* fall through */ 1928 default: 1929 qemu_log_mask(LOG_GUEST_ERROR, 1930 "DRACR[%d]: Bad value for AP bits: 0x%" 1931 PRIx32 "\n", n, ap); 1932 } 1933 } 1934 1935 /* execute never */ 1936 if (xn) { 1937 result->f.prot &= ~PAGE_EXEC; 1938 } 1939 } 1940 } 1941 1942 fi->type = ARMFault_Permission; 1943 fi->level = 1; 1944 return !(result->f.prot & (1 << access_type)); 1945 } 1946 1947 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address, 1948 MMUAccessType access_type, ARMMMUIdx mmu_idx, 1949 bool secure, GetPhysAddrResult *result, 1950 ARMMMUFaultInfo *fi, uint32_t *mregion) 1951 { 1952 /* 1953 * Perform a PMSAv8 MPU lookup (without also doing the SAU check 1954 * that a full phys-to-virt translation does). 1955 * mregion is (if not NULL) set to the region number which matched, 1956 * or -1 if no region number is returned (MPU off, address did not 1957 * hit a region, address hit in multiple regions). 1958 * If the region hit doesn't cover the entire TARGET_PAGE the address 1959 * is within, then we set the result page_size to 1 to force the 1960 * memory system to use a subpage. 1961 */ 1962 ARMCPU *cpu = env_archcpu(env); 1963 bool is_user = regime_is_user(env, mmu_idx); 1964 int n; 1965 int matchregion = -1; 1966 bool hit = false; 1967 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 1968 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 1969 1970 result->f.lg_page_size = TARGET_PAGE_BITS; 1971 result->f.phys_addr = address; 1972 result->f.prot = 0; 1973 if (mregion) { 1974 *mregion = -1; 1975 } 1976 1977 /* 1978 * Unlike the ARM ARM pseudocode, we don't need to check whether this 1979 * was an exception vector read from the vector table (which is always 1980 * done using the default system address map), because those accesses 1981 * are done in arm_v7m_load_vector(), which always does a direct 1982 * read using address_space_ldl(), rather than going via this function. 1983 */ 1984 if (regime_translation_disabled(env, mmu_idx, secure)) { /* MPU disabled */ 1985 hit = true; 1986 } else if (m_is_ppb_region(env, address)) { 1987 hit = true; 1988 } else { 1989 if (pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) { 1990 hit = true; 1991 } 1992 1993 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 1994 /* region search */ 1995 /* 1996 * Note that the base address is bits [31:5] from the register 1997 * with bits [4:0] all zeroes, but the limit address is bits 1998 * [31:5] from the register with bits [4:0] all ones. 1999 */ 2000 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f; 2001 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f; 2002 2003 if (!(env->pmsav8.rlar[secure][n] & 0x1)) { 2004 /* Region disabled */ 2005 continue; 2006 } 2007 2008 if (address < base || address > limit) { 2009 /* 2010 * Address not in this region. We must check whether the 2011 * region covers addresses in the same page as our address. 2012 * In that case we must not report a size that covers the 2013 * whole page for a subsequent hit against a different MPU 2014 * region or the background region, because it would result in 2015 * incorrect TLB hits for subsequent accesses to addresses that 2016 * are in this MPU region. 2017 */ 2018 if (limit >= base && 2019 ranges_overlap(base, limit - base + 1, 2020 addr_page_base, 2021 TARGET_PAGE_SIZE)) { 2022 result->f.lg_page_size = 0; 2023 } 2024 continue; 2025 } 2026 2027 if (base > addr_page_base || limit < addr_page_limit) { 2028 result->f.lg_page_size = 0; 2029 } 2030 2031 if (matchregion != -1) { 2032 /* 2033 * Multiple regions match -- always a failure (unlike 2034 * PMSAv7 where highest-numbered-region wins) 2035 */ 2036 fi->type = ARMFault_Permission; 2037 fi->level = 1; 2038 return true; 2039 } 2040 2041 matchregion = n; 2042 hit = true; 2043 } 2044 } 2045 2046 if (!hit) { 2047 /* background fault */ 2048 fi->type = ARMFault_Background; 2049 return true; 2050 } 2051 2052 if (matchregion == -1) { 2053 /* hit using the background region */ 2054 get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot); 2055 } else { 2056 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2); 2057 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1); 2058 bool pxn = false; 2059 2060 if (arm_feature(env, ARM_FEATURE_V8_1M)) { 2061 pxn = extract32(env->pmsav8.rlar[secure][matchregion], 4, 1); 2062 } 2063 2064 if (m_is_system_region(env, address)) { 2065 /* System space is always execute never */ 2066 xn = 1; 2067 } 2068 2069 result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap); 2070 if (result->f.prot && !xn && !(pxn && !is_user)) { 2071 result->f.prot |= PAGE_EXEC; 2072 } 2073 /* 2074 * We don't need to look the attribute up in the MAIR0/MAIR1 2075 * registers because that only tells us about cacheability. 2076 */ 2077 if (mregion) { 2078 *mregion = matchregion; 2079 } 2080 } 2081 2082 fi->type = ARMFault_Permission; 2083 fi->level = 1; 2084 return !(result->f.prot & (1 << access_type)); 2085 } 2086 2087 static bool v8m_is_sau_exempt(CPUARMState *env, 2088 uint32_t address, MMUAccessType access_type) 2089 { 2090 /* 2091 * The architecture specifies that certain address ranges are 2092 * exempt from v8M SAU/IDAU checks. 2093 */ 2094 return 2095 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) || 2096 (address >= 0xe0000000 && address <= 0xe0002fff) || 2097 (address >= 0xe000e000 && address <= 0xe000efff) || 2098 (address >= 0xe002e000 && address <= 0xe002efff) || 2099 (address >= 0xe0040000 && address <= 0xe0041fff) || 2100 (address >= 0xe00ff000 && address <= 0xe00fffff); 2101 } 2102 2103 void v8m_security_lookup(CPUARMState *env, uint32_t address, 2104 MMUAccessType access_type, ARMMMUIdx mmu_idx, 2105 bool is_secure, V8M_SAttributes *sattrs) 2106 { 2107 /* 2108 * Look up the security attributes for this address. Compare the 2109 * pseudocode SecurityCheck() function. 2110 * We assume the caller has zero-initialized *sattrs. 2111 */ 2112 ARMCPU *cpu = env_archcpu(env); 2113 int r; 2114 bool idau_exempt = false, idau_ns = true, idau_nsc = true; 2115 int idau_region = IREGION_NOTVALID; 2116 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 2117 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 2118 2119 if (cpu->idau) { 2120 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau); 2121 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau); 2122 2123 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns, 2124 &idau_nsc); 2125 } 2126 2127 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) { 2128 /* 0xf0000000..0xffffffff is always S for insn fetches */ 2129 return; 2130 } 2131 2132 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) { 2133 sattrs->ns = !is_secure; 2134 return; 2135 } 2136 2137 if (idau_region != IREGION_NOTVALID) { 2138 sattrs->irvalid = true; 2139 sattrs->iregion = idau_region; 2140 } 2141 2142 switch (env->sau.ctrl & 3) { 2143 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */ 2144 break; 2145 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */ 2146 sattrs->ns = true; 2147 break; 2148 default: /* SAU.ENABLE == 1 */ 2149 for (r = 0; r < cpu->sau_sregion; r++) { 2150 if (env->sau.rlar[r] & 1) { 2151 uint32_t base = env->sau.rbar[r] & ~0x1f; 2152 uint32_t limit = env->sau.rlar[r] | 0x1f; 2153 2154 if (base <= address && limit >= address) { 2155 if (base > addr_page_base || limit < addr_page_limit) { 2156 sattrs->subpage = true; 2157 } 2158 if (sattrs->srvalid) { 2159 /* 2160 * If we hit in more than one region then we must report 2161 * as Secure, not NS-Callable, with no valid region 2162 * number info. 2163 */ 2164 sattrs->ns = false; 2165 sattrs->nsc = false; 2166 sattrs->sregion = 0; 2167 sattrs->srvalid = false; 2168 break; 2169 } else { 2170 if (env->sau.rlar[r] & 2) { 2171 sattrs->nsc = true; 2172 } else { 2173 sattrs->ns = true; 2174 } 2175 sattrs->srvalid = true; 2176 sattrs->sregion = r; 2177 } 2178 } else { 2179 /* 2180 * Address not in this region. We must check whether the 2181 * region covers addresses in the same page as our address. 2182 * In that case we must not report a size that covers the 2183 * whole page for a subsequent hit against a different MPU 2184 * region or the background region, because it would result 2185 * in incorrect TLB hits for subsequent accesses to 2186 * addresses that are in this MPU region. 2187 */ 2188 if (limit >= base && 2189 ranges_overlap(base, limit - base + 1, 2190 addr_page_base, 2191 TARGET_PAGE_SIZE)) { 2192 sattrs->subpage = true; 2193 } 2194 } 2195 } 2196 } 2197 break; 2198 } 2199 2200 /* 2201 * The IDAU will override the SAU lookup results if it specifies 2202 * higher security than the SAU does. 2203 */ 2204 if (!idau_ns) { 2205 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) { 2206 sattrs->ns = false; 2207 sattrs->nsc = idau_nsc; 2208 } 2209 } 2210 } 2211 2212 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address, 2213 MMUAccessType access_type, ARMMMUIdx mmu_idx, 2214 bool secure, GetPhysAddrResult *result, 2215 ARMMMUFaultInfo *fi) 2216 { 2217 V8M_SAttributes sattrs = {}; 2218 bool ret; 2219 2220 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 2221 v8m_security_lookup(env, address, access_type, mmu_idx, 2222 secure, &sattrs); 2223 if (access_type == MMU_INST_FETCH) { 2224 /* 2225 * Instruction fetches always use the MMU bank and the 2226 * transaction attribute determined by the fetch address, 2227 * regardless of CPU state. This is painful for QEMU 2228 * to handle, because it would mean we need to encode 2229 * into the mmu_idx not just the (user, negpri) information 2230 * for the current security state but also that for the 2231 * other security state, which would balloon the number 2232 * of mmu_idx values needed alarmingly. 2233 * Fortunately we can avoid this because it's not actually 2234 * possible to arbitrarily execute code from memory with 2235 * the wrong security attribute: it will always generate 2236 * an exception of some kind or another, apart from the 2237 * special case of an NS CPU executing an SG instruction 2238 * in S&NSC memory. So we always just fail the translation 2239 * here and sort things out in the exception handler 2240 * (including possibly emulating an SG instruction). 2241 */ 2242 if (sattrs.ns != !secure) { 2243 if (sattrs.nsc) { 2244 fi->type = ARMFault_QEMU_NSCExec; 2245 } else { 2246 fi->type = ARMFault_QEMU_SFault; 2247 } 2248 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS; 2249 result->f.phys_addr = address; 2250 result->f.prot = 0; 2251 return true; 2252 } 2253 } else { 2254 /* 2255 * For data accesses we always use the MMU bank indicated 2256 * by the current CPU state, but the security attributes 2257 * might downgrade a secure access to nonsecure. 2258 */ 2259 if (sattrs.ns) { 2260 result->f.attrs.secure = false; 2261 } else if (!secure) { 2262 /* 2263 * NS access to S memory must fault. 2264 * Architecturally we should first check whether the 2265 * MPU information for this address indicates that we 2266 * are doing an unaligned access to Device memory, which 2267 * should generate a UsageFault instead. QEMU does not 2268 * currently check for that kind of unaligned access though. 2269 * If we added it we would need to do so as a special case 2270 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt(). 2271 */ 2272 fi->type = ARMFault_QEMU_SFault; 2273 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS; 2274 result->f.phys_addr = address; 2275 result->f.prot = 0; 2276 return true; 2277 } 2278 } 2279 } 2280 2281 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, secure, 2282 result, fi, NULL); 2283 if (sattrs.subpage) { 2284 result->f.lg_page_size = 0; 2285 } 2286 return ret; 2287 } 2288 2289 /* 2290 * Translate from the 4-bit stage 2 representation of 2291 * memory attributes (without cache-allocation hints) to 2292 * the 8-bit representation of the stage 1 MAIR registers 2293 * (which includes allocation hints). 2294 * 2295 * ref: shared/translation/attrs/S2AttrDecode() 2296 * .../S2ConvertAttrsHints() 2297 */ 2298 static uint8_t convert_stage2_attrs(uint64_t hcr, uint8_t s2attrs) 2299 { 2300 uint8_t hiattr = extract32(s2attrs, 2, 2); 2301 uint8_t loattr = extract32(s2attrs, 0, 2); 2302 uint8_t hihint = 0, lohint = 0; 2303 2304 if (hiattr != 0) { /* normal memory */ 2305 if (hcr & HCR_CD) { /* cache disabled */ 2306 hiattr = loattr = 1; /* non-cacheable */ 2307 } else { 2308 if (hiattr != 1) { /* Write-through or write-back */ 2309 hihint = 3; /* RW allocate */ 2310 } 2311 if (loattr != 1) { /* Write-through or write-back */ 2312 lohint = 3; /* RW allocate */ 2313 } 2314 } 2315 } 2316 2317 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint; 2318 } 2319 2320 /* 2321 * Combine either inner or outer cacheability attributes for normal 2322 * memory, according to table D4-42 and pseudocode procedure 2323 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM). 2324 * 2325 * NB: only stage 1 includes allocation hints (RW bits), leading to 2326 * some asymmetry. 2327 */ 2328 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2) 2329 { 2330 if (s1 == 4 || s2 == 4) { 2331 /* non-cacheable has precedence */ 2332 return 4; 2333 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) { 2334 /* stage 1 write-through takes precedence */ 2335 return s1; 2336 } else if (extract32(s2, 2, 2) == 2) { 2337 /* stage 2 write-through takes precedence, but the allocation hint 2338 * is still taken from stage 1 2339 */ 2340 return (2 << 2) | extract32(s1, 0, 2); 2341 } else { /* write-back */ 2342 return s1; 2343 } 2344 } 2345 2346 /* 2347 * Combine the memory type and cacheability attributes of 2348 * s1 and s2 for the HCR_EL2.FWB == 0 case, returning the 2349 * combined attributes in MAIR_EL1 format. 2350 */ 2351 static uint8_t combined_attrs_nofwb(uint64_t hcr, 2352 ARMCacheAttrs s1, ARMCacheAttrs s2) 2353 { 2354 uint8_t s1lo, s2lo, s1hi, s2hi, s2_mair_attrs, ret_attrs; 2355 2356 s2_mair_attrs = convert_stage2_attrs(hcr, s2.attrs); 2357 2358 s1lo = extract32(s1.attrs, 0, 4); 2359 s2lo = extract32(s2_mair_attrs, 0, 4); 2360 s1hi = extract32(s1.attrs, 4, 4); 2361 s2hi = extract32(s2_mair_attrs, 4, 4); 2362 2363 /* Combine memory type and cacheability attributes */ 2364 if (s1hi == 0 || s2hi == 0) { 2365 /* Device has precedence over normal */ 2366 if (s1lo == 0 || s2lo == 0) { 2367 /* nGnRnE has precedence over anything */ 2368 ret_attrs = 0; 2369 } else if (s1lo == 4 || s2lo == 4) { 2370 /* non-Reordering has precedence over Reordering */ 2371 ret_attrs = 4; /* nGnRE */ 2372 } else if (s1lo == 8 || s2lo == 8) { 2373 /* non-Gathering has precedence over Gathering */ 2374 ret_attrs = 8; /* nGRE */ 2375 } else { 2376 ret_attrs = 0xc; /* GRE */ 2377 } 2378 } else { /* Normal memory */ 2379 /* Outer/inner cacheability combine independently */ 2380 ret_attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4 2381 | combine_cacheattr_nibble(s1lo, s2lo); 2382 } 2383 return ret_attrs; 2384 } 2385 2386 static uint8_t force_cacheattr_nibble_wb(uint8_t attr) 2387 { 2388 /* 2389 * Given the 4 bits specifying the outer or inner cacheability 2390 * in MAIR format, return a value specifying Normal Write-Back, 2391 * with the allocation and transient hints taken from the input 2392 * if the input specified some kind of cacheable attribute. 2393 */ 2394 if (attr == 0 || attr == 4) { 2395 /* 2396 * 0 == an UNPREDICTABLE encoding 2397 * 4 == Non-cacheable 2398 * Either way, force Write-Back RW allocate non-transient 2399 */ 2400 return 0xf; 2401 } 2402 /* Change WriteThrough to WriteBack, keep allocation and transient hints */ 2403 return attr | 4; 2404 } 2405 2406 /* 2407 * Combine the memory type and cacheability attributes of 2408 * s1 and s2 for the HCR_EL2.FWB == 1 case, returning the 2409 * combined attributes in MAIR_EL1 format. 2410 */ 2411 static uint8_t combined_attrs_fwb(ARMCacheAttrs s1, ARMCacheAttrs s2) 2412 { 2413 switch (s2.attrs) { 2414 case 7: 2415 /* Use stage 1 attributes */ 2416 return s1.attrs; 2417 case 6: 2418 /* 2419 * Force Normal Write-Back. Note that if S1 is Normal cacheable 2420 * then we take the allocation hints from it; otherwise it is 2421 * RW allocate, non-transient. 2422 */ 2423 if ((s1.attrs & 0xf0) == 0) { 2424 /* S1 is Device */ 2425 return 0xff; 2426 } 2427 /* Need to check the Inner and Outer nibbles separately */ 2428 return force_cacheattr_nibble_wb(s1.attrs & 0xf) | 2429 force_cacheattr_nibble_wb(s1.attrs >> 4) << 4; 2430 case 5: 2431 /* If S1 attrs are Device, use them; otherwise Normal Non-cacheable */ 2432 if ((s1.attrs & 0xf0) == 0) { 2433 return s1.attrs; 2434 } 2435 return 0x44; 2436 case 0 ... 3: 2437 /* Force Device, of subtype specified by S2 */ 2438 return s2.attrs << 2; 2439 default: 2440 /* 2441 * RESERVED values (including RES0 descriptor bit [5] being nonzero); 2442 * arbitrarily force Device. 2443 */ 2444 return 0; 2445 } 2446 } 2447 2448 /* 2449 * Combine S1 and S2 cacheability/shareability attributes, per D4.5.4 2450 * and CombineS1S2Desc() 2451 * 2452 * @env: CPUARMState 2453 * @s1: Attributes from stage 1 walk 2454 * @s2: Attributes from stage 2 walk 2455 */ 2456 static ARMCacheAttrs combine_cacheattrs(uint64_t hcr, 2457 ARMCacheAttrs s1, ARMCacheAttrs s2) 2458 { 2459 ARMCacheAttrs ret; 2460 bool tagged = false; 2461 2462 assert(s2.is_s2_format && !s1.is_s2_format); 2463 ret.is_s2_format = false; 2464 2465 if (s1.attrs == 0xf0) { 2466 tagged = true; 2467 s1.attrs = 0xff; 2468 } 2469 2470 /* Combine shareability attributes (table D4-43) */ 2471 if (s1.shareability == 2 || s2.shareability == 2) { 2472 /* if either are outer-shareable, the result is outer-shareable */ 2473 ret.shareability = 2; 2474 } else if (s1.shareability == 3 || s2.shareability == 3) { 2475 /* if either are inner-shareable, the result is inner-shareable */ 2476 ret.shareability = 3; 2477 } else { 2478 /* both non-shareable */ 2479 ret.shareability = 0; 2480 } 2481 2482 /* Combine memory type and cacheability attributes */ 2483 if (hcr & HCR_FWB) { 2484 ret.attrs = combined_attrs_fwb(s1, s2); 2485 } else { 2486 ret.attrs = combined_attrs_nofwb(hcr, s1, s2); 2487 } 2488 2489 /* 2490 * Any location for which the resultant memory type is any 2491 * type of Device memory is always treated as Outer Shareable. 2492 * Any location for which the resultant memory type is Normal 2493 * Inner Non-cacheable, Outer Non-cacheable is always treated 2494 * as Outer Shareable. 2495 * TODO: FEAT_XS adds another value (0x40) also meaning iNCoNC 2496 */ 2497 if ((ret.attrs & 0xf0) == 0 || ret.attrs == 0x44) { 2498 ret.shareability = 2; 2499 } 2500 2501 /* TODO: CombineS1S2Desc does not consider transient, only WB, RWA. */ 2502 if (tagged && ret.attrs == 0xff) { 2503 ret.attrs = 0xf0; 2504 } 2505 2506 return ret; 2507 } 2508 2509 /* 2510 * MMU disabled. S1 addresses within aa64 translation regimes are 2511 * still checked for bounds -- see AArch64.S1DisabledOutput(). 2512 */ 2513 static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address, 2514 MMUAccessType access_type, 2515 ARMMMUIdx mmu_idx, bool is_secure, 2516 GetPhysAddrResult *result, 2517 ARMMMUFaultInfo *fi) 2518 { 2519 uint8_t memattr = 0x00; /* Device nGnRnE */ 2520 uint8_t shareability = 0; /* non-sharable */ 2521 int r_el; 2522 2523 switch (mmu_idx) { 2524 case ARMMMUIdx_Stage2: 2525 case ARMMMUIdx_Stage2_S: 2526 case ARMMMUIdx_Phys_NS: 2527 case ARMMMUIdx_Phys_S: 2528 break; 2529 2530 default: 2531 r_el = regime_el(env, mmu_idx); 2532 if (arm_el_is_aa64(env, r_el)) { 2533 int pamax = arm_pamax(env_archcpu(env)); 2534 uint64_t tcr = env->cp15.tcr_el[r_el]; 2535 int addrtop, tbi; 2536 2537 tbi = aa64_va_parameter_tbi(tcr, mmu_idx); 2538 if (access_type == MMU_INST_FETCH) { 2539 tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx); 2540 } 2541 tbi = (tbi >> extract64(address, 55, 1)) & 1; 2542 addrtop = (tbi ? 55 : 63); 2543 2544 if (extract64(address, pamax, addrtop - pamax + 1) != 0) { 2545 fi->type = ARMFault_AddressSize; 2546 fi->level = 0; 2547 fi->stage2 = false; 2548 return 1; 2549 } 2550 2551 /* 2552 * When TBI is disabled, we've just validated that all of the 2553 * bits above PAMax are zero, so logically we only need to 2554 * clear the top byte for TBI. But it's clearer to follow 2555 * the pseudocode set of addrdesc.paddress. 2556 */ 2557 address = extract64(address, 0, 52); 2558 } 2559 2560 /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */ 2561 if (r_el == 1) { 2562 uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure); 2563 if (hcr & HCR_DC) { 2564 if (hcr & HCR_DCT) { 2565 memattr = 0xf0; /* Tagged, Normal, WB, RWA */ 2566 } else { 2567 memattr = 0xff; /* Normal, WB, RWA */ 2568 } 2569 } 2570 } 2571 if (memattr == 0 && access_type == MMU_INST_FETCH) { 2572 if (regime_sctlr(env, mmu_idx) & SCTLR_I) { 2573 memattr = 0xee; /* Normal, WT, RA, NT */ 2574 } else { 2575 memattr = 0x44; /* Normal, NC, No */ 2576 } 2577 shareability = 2; /* outer sharable */ 2578 } 2579 result->cacheattrs.is_s2_format = false; 2580 break; 2581 } 2582 2583 result->f.phys_addr = address; 2584 result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 2585 result->f.lg_page_size = TARGET_PAGE_BITS; 2586 result->cacheattrs.shareability = shareability; 2587 result->cacheattrs.attrs = memattr; 2588 return false; 2589 } 2590 2591 static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw, 2592 target_ulong address, 2593 MMUAccessType access_type, 2594 GetPhysAddrResult *result, 2595 ARMMMUFaultInfo *fi) 2596 { 2597 hwaddr ipa; 2598 int s1_prot, s1_lgpgsz; 2599 bool is_secure = ptw->in_secure; 2600 bool ret, ipa_secure, s2walk_secure; 2601 ARMCacheAttrs cacheattrs1; 2602 bool is_el0; 2603 uint64_t hcr; 2604 2605 ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi); 2606 2607 /* If S1 fails or S2 is disabled, return early. */ 2608 if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2, is_secure)) { 2609 return ret; 2610 } 2611 2612 ipa = result->f.phys_addr; 2613 ipa_secure = result->f.attrs.secure; 2614 if (is_secure) { 2615 /* Select TCR based on the NS bit from the S1 walk. */ 2616 s2walk_secure = !(ipa_secure 2617 ? env->cp15.vstcr_el2 & VSTCR_SW 2618 : env->cp15.vtcr_el2 & VTCR_NSW); 2619 } else { 2620 assert(!ipa_secure); 2621 s2walk_secure = false; 2622 } 2623 2624 is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0; 2625 ptw->in_mmu_idx = s2walk_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2; 2626 ptw->in_ptw_idx = s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS; 2627 ptw->in_secure = s2walk_secure; 2628 2629 /* 2630 * S1 is done, now do S2 translation. 2631 * Save the stage1 results so that we may merge prot and cacheattrs later. 2632 */ 2633 s1_prot = result->f.prot; 2634 s1_lgpgsz = result->f.lg_page_size; 2635 cacheattrs1 = result->cacheattrs; 2636 memset(result, 0, sizeof(*result)); 2637 2638 ret = get_phys_addr_lpae(env, ptw, ipa, access_type, is_el0, result, fi); 2639 fi->s2addr = ipa; 2640 2641 /* Combine the S1 and S2 perms. */ 2642 result->f.prot &= s1_prot; 2643 2644 /* If S2 fails, return early. */ 2645 if (ret) { 2646 return ret; 2647 } 2648 2649 /* 2650 * Use the maximum of the S1 & S2 page size, so that invalidation 2651 * of pages > TARGET_PAGE_SIZE works correctly. 2652 */ 2653 if (result->f.lg_page_size < s1_lgpgsz) { 2654 result->f.lg_page_size = s1_lgpgsz; 2655 } 2656 2657 /* Combine the S1 and S2 cache attributes. */ 2658 hcr = arm_hcr_el2_eff_secstate(env, is_secure); 2659 if (hcr & HCR_DC) { 2660 /* 2661 * HCR.DC forces the first stage attributes to 2662 * Normal Non-Shareable, 2663 * Inner Write-Back Read-Allocate Write-Allocate, 2664 * Outer Write-Back Read-Allocate Write-Allocate. 2665 * Do not overwrite Tagged within attrs. 2666 */ 2667 if (cacheattrs1.attrs != 0xf0) { 2668 cacheattrs1.attrs = 0xff; 2669 } 2670 cacheattrs1.shareability = 0; 2671 } 2672 result->cacheattrs = combine_cacheattrs(hcr, cacheattrs1, 2673 result->cacheattrs); 2674 2675 /* 2676 * Check if IPA translates to secure or non-secure PA space. 2677 * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA. 2678 */ 2679 result->f.attrs.secure = 2680 (is_secure 2681 && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW)) 2682 && (ipa_secure 2683 || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)))); 2684 2685 return false; 2686 } 2687 2688 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw, 2689 target_ulong address, 2690 MMUAccessType access_type, 2691 GetPhysAddrResult *result, 2692 ARMMMUFaultInfo *fi) 2693 { 2694 ARMMMUIdx mmu_idx = ptw->in_mmu_idx; 2695 bool is_secure = ptw->in_secure; 2696 ARMMMUIdx s1_mmu_idx; 2697 2698 /* 2699 * The page table entries may downgrade secure to non-secure, but 2700 * cannot upgrade an non-secure translation regime's attributes 2701 * to secure. 2702 */ 2703 result->f.attrs.secure = is_secure; 2704 2705 switch (mmu_idx) { 2706 case ARMMMUIdx_Phys_S: 2707 case ARMMMUIdx_Phys_NS: 2708 /* Checking Phys early avoids special casing later vs regime_el. */ 2709 return get_phys_addr_disabled(env, address, access_type, mmu_idx, 2710 is_secure, result, fi); 2711 2712 case ARMMMUIdx_Stage1_E0: 2713 case ARMMMUIdx_Stage1_E1: 2714 case ARMMMUIdx_Stage1_E1_PAN: 2715 /* First stage lookup uses second stage for ptw. */ 2716 ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2; 2717 break; 2718 2719 case ARMMMUIdx_E10_0: 2720 s1_mmu_idx = ARMMMUIdx_Stage1_E0; 2721 goto do_twostage; 2722 case ARMMMUIdx_E10_1: 2723 s1_mmu_idx = ARMMMUIdx_Stage1_E1; 2724 goto do_twostage; 2725 case ARMMMUIdx_E10_1_PAN: 2726 s1_mmu_idx = ARMMMUIdx_Stage1_E1_PAN; 2727 do_twostage: 2728 /* 2729 * Call ourselves recursively to do the stage 1 and then stage 2 2730 * translations if mmu_idx is a two-stage regime, and EL2 present. 2731 * Otherwise, a stage1+stage2 translation is just stage 1. 2732 */ 2733 ptw->in_mmu_idx = mmu_idx = s1_mmu_idx; 2734 if (arm_feature(env, ARM_FEATURE_EL2)) { 2735 return get_phys_addr_twostage(env, ptw, address, access_type, 2736 result, fi); 2737 } 2738 /* fall through */ 2739 2740 default: 2741 /* Single stage and second stage uses physical for ptw. */ 2742 ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS; 2743 break; 2744 } 2745 2746 result->f.attrs.user = regime_is_user(env, mmu_idx); 2747 2748 /* 2749 * Fast Context Switch Extension. This doesn't exist at all in v8. 2750 * In v7 and earlier it affects all stage 1 translations. 2751 */ 2752 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_Stage2 2753 && !arm_feature(env, ARM_FEATURE_V8)) { 2754 if (regime_el(env, mmu_idx) == 3) { 2755 address += env->cp15.fcseidr_s; 2756 } else { 2757 address += env->cp15.fcseidr_ns; 2758 } 2759 } 2760 2761 if (arm_feature(env, ARM_FEATURE_PMSA)) { 2762 bool ret; 2763 result->f.lg_page_size = TARGET_PAGE_BITS; 2764 2765 if (arm_feature(env, ARM_FEATURE_V8)) { 2766 /* PMSAv8 */ 2767 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx, 2768 is_secure, result, fi); 2769 } else if (arm_feature(env, ARM_FEATURE_V7)) { 2770 /* PMSAv7 */ 2771 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, 2772 is_secure, result, fi); 2773 } else { 2774 /* Pre-v7 MPU */ 2775 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx, 2776 is_secure, result, fi); 2777 } 2778 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32 2779 " mmu_idx %u -> %s (prot %c%c%c)\n", 2780 access_type == MMU_DATA_LOAD ? "reading" : 2781 (access_type == MMU_DATA_STORE ? "writing" : "execute"), 2782 (uint32_t)address, mmu_idx, 2783 ret ? "Miss" : "Hit", 2784 result->f.prot & PAGE_READ ? 'r' : '-', 2785 result->f.prot & PAGE_WRITE ? 'w' : '-', 2786 result->f.prot & PAGE_EXEC ? 'x' : '-'); 2787 2788 return ret; 2789 } 2790 2791 /* Definitely a real MMU, not an MPU */ 2792 2793 if (regime_translation_disabled(env, mmu_idx, is_secure)) { 2794 return get_phys_addr_disabled(env, address, access_type, mmu_idx, 2795 is_secure, result, fi); 2796 } 2797 2798 if (regime_using_lpae_format(env, mmu_idx)) { 2799 return get_phys_addr_lpae(env, ptw, address, access_type, false, 2800 result, fi); 2801 } else if (arm_feature(env, ARM_FEATURE_V7) || 2802 regime_sctlr(env, mmu_idx) & SCTLR_XP) { 2803 return get_phys_addr_v6(env, ptw, address, access_type, result, fi); 2804 } else { 2805 return get_phys_addr_v5(env, ptw, address, access_type, result, fi); 2806 } 2807 } 2808 2809 bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address, 2810 MMUAccessType access_type, ARMMMUIdx mmu_idx, 2811 bool is_secure, GetPhysAddrResult *result, 2812 ARMMMUFaultInfo *fi) 2813 { 2814 S1Translate ptw = { 2815 .in_mmu_idx = mmu_idx, 2816 .in_secure = is_secure, 2817 }; 2818 return get_phys_addr_with_struct(env, &ptw, address, access_type, 2819 result, fi); 2820 } 2821 2822 bool get_phys_addr(CPUARMState *env, target_ulong address, 2823 MMUAccessType access_type, ARMMMUIdx mmu_idx, 2824 GetPhysAddrResult *result, ARMMMUFaultInfo *fi) 2825 { 2826 bool is_secure; 2827 2828 switch (mmu_idx) { 2829 case ARMMMUIdx_E10_0: 2830 case ARMMMUIdx_E10_1: 2831 case ARMMMUIdx_E10_1_PAN: 2832 case ARMMMUIdx_E20_0: 2833 case ARMMMUIdx_E20_2: 2834 case ARMMMUIdx_E20_2_PAN: 2835 case ARMMMUIdx_Stage1_E0: 2836 case ARMMMUIdx_Stage1_E1: 2837 case ARMMMUIdx_Stage1_E1_PAN: 2838 case ARMMMUIdx_E2: 2839 is_secure = arm_is_secure_below_el3(env); 2840 break; 2841 case ARMMMUIdx_Stage2: 2842 case ARMMMUIdx_Phys_NS: 2843 case ARMMMUIdx_MPrivNegPri: 2844 case ARMMMUIdx_MUserNegPri: 2845 case ARMMMUIdx_MPriv: 2846 case ARMMMUIdx_MUser: 2847 is_secure = false; 2848 break; 2849 case ARMMMUIdx_E3: 2850 case ARMMMUIdx_Stage2_S: 2851 case ARMMMUIdx_Phys_S: 2852 case ARMMMUIdx_MSPrivNegPri: 2853 case ARMMMUIdx_MSUserNegPri: 2854 case ARMMMUIdx_MSPriv: 2855 case ARMMMUIdx_MSUser: 2856 is_secure = true; 2857 break; 2858 default: 2859 g_assert_not_reached(); 2860 } 2861 return get_phys_addr_with_secure(env, address, access_type, mmu_idx, 2862 is_secure, result, fi); 2863 } 2864 2865 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr, 2866 MemTxAttrs *attrs) 2867 { 2868 ARMCPU *cpu = ARM_CPU(cs); 2869 CPUARMState *env = &cpu->env; 2870 S1Translate ptw = { 2871 .in_mmu_idx = arm_mmu_idx(env), 2872 .in_secure = arm_is_secure(env), 2873 .in_debug = true, 2874 }; 2875 GetPhysAddrResult res = {}; 2876 ARMMMUFaultInfo fi = {}; 2877 bool ret; 2878 2879 ret = get_phys_addr_with_struct(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi); 2880 *attrs = res.f.attrs; 2881 2882 if (ret) { 2883 return -1; 2884 } 2885 return res.f.phys_addr; 2886 } 2887